2.1 - The AWS Shared Responsibility Model
AWS Certified Cloud Practitioner objective 2.1 covers the AWS Shared Responsibility Model, which splits security duties. AWS is responsible for security OF the cloud - the hardware, global infrastructure and the physical security of its data centers - regardless of the service used. The customer is responsible for security IN the cloud: for example, under IaaS the customer patches the guest operating system, configures IAM users and permissions, and chooses and configures encryption of their data. The split shifts with the service model, but managing your own access and data is always yours. A recommended baseline is to protect the account root user by enabling MFA and avoiding daily use of root. Expect scenario questions that name a security task and a service and ask whether AWS or the customer is responsible - anchor on OF the cloud versus IN the cloud.
AWS = security OF the cloud (hardware, global infra, physical data-center security). Customer = security IN the cloud (guest OS patching, IAM, data encryption). Protect root = enable MFA, avoid daily use.
Practice questions
1. Under the AWS Shared Responsibility Model, AWS is responsible for:
- Security IN the cloud (your data, IAM config)
- Security OF the cloud (hardware, global infrastructure) (correct answer)
- Patching your EC2 guest operating system
- Configuring your security group rules
AWS secures the cloud itself (hardware, facilities, global infrastructure, managed-service software). Customers secure what they put IN the cloud (data, IAM, OS patching, security groups).
2. What is the recommended way to protect the AWS account root user?
- Enable MFA and avoid daily use of root (correct answer)
- Share the root password with the whole team
- Create access keys for root and script with them
- Disable IAM and use only root
Secure root with MFA, don't create root access keys, and use it only for the few tasks that require it — do daily work with IAM users/roles.
3. Under the AWS shared responsibility model, who is responsible for patching the guest operating system on an EC2 instance?
- AWS
- The customer (correct answer)
- AWS Support automatically
- The AWS Marketplace vendor
For EC2 (IaaS), the customer manages the guest OS including patches and updates. AWS handles the physical host and hypervisor.
4. AWS is always responsible for which of the following, regardless of the service the customer uses?
- Configuring security groups
- Managing IAM user passwords
- Physical security of data centers (correct answer)
- Encrypting customer data at rest
Security of the cloud, including physical data-center security, is always AWS's responsibility. Security groups, IAM passwords, and enabling encryption are customer tasks.
5. For a fully managed service like Amazon S3, how does responsibility for the underlying infrastructure differ from EC2?
- The customer must patch the S3 servers
- AWS manages the infrastructure and OS; the customer manages data and access (correct answer)
- The customer manages the S3 hypervisor
- AWS manages the customer's bucket policies
For managed services like S3, AWS handles the infrastructure and OS patching, while the customer controls data, encryption choices, and access permissions.
6. Which TWO tasks are the customer's responsibility in the shared responsibility model? (Choose two.)
- Managing IAM users, roles and permissions (correct answer)
- Configuring security groups and network ACLs (correct answer)
- Patching the underlying hypervisor
- Replacing failed disk drives in AWS facilities
Managing identities (IAM) and configuring network controls like security groups are customer responsibilities. Patching the hypervisor and replacing hardware are AWS responsibilities.